Why was the 737 main rudder servo valve’s vulnerability to causing uncommanded reversals never discovered in testing?

Question

As was discovered during the NTSB investigation into the crash of USAir Flight 427, the design of the servo valve inside the main rudder power control unit (PCU) formerly used on 737 Original- and Classic-series aircraft was vulnerable to causing uncommanded rudder reversals if the valve’s secondary slide jammed to the valve housing at a position sufficiently far from neutral (the precise threshold varies depending on the valve and whether the secondary slide jammed in the extend or the retract position).

The valve was designed so that a secondary-slide-to-valve-housing jam would not cause a reversal:

(Image source, page 83 of report/page 107 of PDF file)

However, if the pilot applied a sufficiently fast, abrupt rudder input, this would cause the valve’s primary slide to overtravel past the secondary slide, porting hydraulic fluid in the wrong direction and causing the rudder to move in the direction opposite from that commanded, all the way to its blowdown limit:

(Image source, page 84/108)

Given the potential catastrophic results of an unexpected rudder reversal (especially at lower airspeeds), why wasn’t the valve tested to make sure that it would, in fact, react to a jam in the manner in which it was designed to do so, and, if so, why wasn’t this failure mode discovered in testing?

Answer 1

After the accident the NTSB did very extensive testing on the PCU to determine the cause of the failure. In addition to the flight 427 PCU they tested new units, units that had been removed from other aircraft, and the units from three other crashes (SGR517, UAL585 and SLK185) as well as one selected by Boeing that had minimum tolerances.

They subjected the units to numerous tests. They could not get any of them to fail under any conditions expected during flight. The only test they could get a failure on involved an extreme temperature differential of injecting very hot hydraulic fluid suddenly into a very cold PCU. The report states "The extreme temperature differential produced during this test condition would not be expected during normal flight operations." (NTSB report page 79)

All of the PCUs passed the testing procedures for certification even after the failure testing. The temperatures of the PCU and hydraulic fluid on a 737 during flight were tested by Boeing and did not match those used for the testing.

So the PCU can only be made to fail under specific, fairly unrealistic conditions that would not be expected during flight. There was no evidence that those temperature conditions were even present during any of the flights where PCU failure was suspected. There was no reason for testing the part during design or certification in conditions that would not be expected to occur.